Listen to this Post
The vulnerability is a cross-site request forgery (CSRF) in the panel name management functionality of 1Panel. The affected endpoint does not implement CSRF defenses such as anti-CSRF tokens or Origin/Referer validation. This allows an attacker to craft a malicious webpage that submits a forged request to change the panel name. When a victim visits the malicious page while authenticated to 1Panel, the browser automatically includes valid session cookies with the request. The server processes the request as legitimate because it lacks mechanisms to verify the request source. The attack exploits the trust between the browser and the server for authenticated sessions. The malicious request is typically sent via a hidden form or JavaScript without user interaction. The endpoint accepts POST requests to modify the panel name parameter. Without CSRF protections, the server cannot distinguish between legitimate user actions and forged requests. The vulnerability requires the victim to have an active session on the 1Panel interface. The attacker must lure the victim to a controlled webpage hosting the exploit code. The exploit payload includes parameters to set the panel name to an arbitrary value. The browser’s same-origin policy does not prevent the request since cookies are sent cross-origin. The vulnerability is inherent in the missing server-side validation for CSRF. The impact is limited to unauthorized panel name changes but could lead to confusion or further attacks. The vulnerability affects all versions from 1.10.33 to 2.0.15. No patched versions are currently available. Mitigations include implementing anti-CSRF tokens or validating Origin/Referer headers. Developers should ensure state-changing endpoints are protected against CSRF. Users should be cautious of phishing attempts until a patch is released.
Platform: 1Panel
Version: 1.10.33-2.0.15
Vulnerability: Panel name CSRF
Severity: Moderate
date: 10 Dec 2025
Prediction: Patch date pending
What Undercode Say:
Analytics
curl -X POST -H “Cookie: sessionid=value” -d “name=malicious” http://localhost:8080/api/panel/name
How Exploit:
Create malicious HTML page with auto-submit form to panel name endpoint. Victim must be logged in. Visit page triggers name change.
Protection from this CVE
Implement anti-CSRF tokens. Validate Origin/Referer headers. Use same-site cookies.
Impact:
Unauthorized panel name modification. Potential confusion or phishing escalation.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
